Fortra patched eight vulnerabilities in BoKS, notably three critical ones: CVE-2026-79901 (CVSS 9.9) is an authentication bypass caused by predictable Active Directory service account passwords generated from a pseudo-random sequence seeded with the current Unix timestamp. An attacker knowing the service principal and approximate password-change time can reproduce and verify password candidates offline. CVE-2026-79898 (CVSS 9.1) is a command injection flaw in the crlserver component exploitable via BCC and WSI REST or SOAP APIs, allowing authenticated users to execute shell commands as root. CVE-2026-12627 (CVSS 9.8) is a stack buffer overflow in the autoregistration functionality enabling remote memory corruption. Additional high- and medium-severity issues include heap buffer overflows, out-of-bounds reads, insecure temporary file usage, and predictable password generation. No known active exploitation has been reported.

Successful exploitation of these vulnerabilities could allow attackers to bypass authentication controls, execute arbitrary commands with root privileges, and cause memory corruption potentially leading to denial of service or code execution. The authentication bypass vulnerability could be exploited without administrative access if the attacker knows the service principal and timing information. The command injection vulnerability allows authenticated users to gain root shell access remotely. The memory corruption flaw could be triggered remotely, posing a risk of system compromise. These impacts are critical given BoKS's role in privileged access management.

Fortra has released official patches addressing all identified vulnerabilities in BoKS. Organizations using BoKS should apply these patches promptly to remediate the critical authentication bypass, command injection, and memory corruption flaws. No mention of any vulnerabilities being exploited in the wild has been made, and the vendor recommends updating to the patched versions as the primary mitigation. No additional temporary workarounds or mitigations were specified.